Report Contents
What OIG Audited
The Department of State (Department) uses a variety of IT systems to execute its global mission. Configuration change control is the process used to ensure that changes to an IT system are formally requested, evaluated, tested, and approved before they are implemented. Changes that affect only local networks can be approved by a post’s Local Configuration Control Board (LCCB). Other changes are required to be reviewed and approved by the Department’s enterprise-wide Information Technology Configuration Control Board (IT CCB).
OIG conducted this audit to determine whether LCCBs are controlling changes to the Department’s IT systems in accordance with Federal requirements and Department policy. The scope of the audit included a review of 236 changes to IT systems approved by LCCBs and detailed testing of 83 changes made to IT systems at 4 posts: Embassy The Hague, The Netherlands; Embassy Branch Office Tel Aviv, Israel; Embassy Seoul, South Korea; and Embassy Dhaka, Bangladesh.
What OIG Recommends
OIG made six recommendations to the Bureau of Information Resource Management (IRM) to improve guidance and oversight of IT configuration change control affecting local networks. On the basis of IRM’s response to a draft of this report, OIG considers all six recommendations resolved, pending further action. A synopsis of IRM’s response to the recommendations offered and OIG’s reply follow each recommendation in the Audit Results section of this report. IRM’s response to a draft of this report is reprinted in Appendix B.
What OIG Found
OIG found that LCCBs at selected posts were complying with some but not all Federal requirements and Department policies governing IT configuration change control that affect local networks. Specifically, the change requests reviewed by OIG for this audit generally complied with requirements and policies for approving IT changes at the local level, and the LCCBs informed the IT CCB about changes when required. However, OIG found that the LCCBs did not perform testing or a security impact analysis for any of the 83 change requests selected by OIG for detailed testing. OIG also identified weaknesses in maintaining documentation and found irregularities in some of the change requests.
The weaknesses identified occurred, in part, because of inadequate guidance and oversight of LCCBs by IRM officials at headquarters. Specifically, current guidance to LCCBs does not provide details of what documentation should be maintained to support a change request. Furthermore, the guidance does not provide information on how to perform and document a security impact analysis or on how to establish the manner in which LCCBs should conduct configuration testing before introducing software or hardware to the production environment. OIG also found that the Department had not provided standardized tools that LCCBs could use to efficiently and consistently review and approve local network IT changes.
Addressing these weaknesses is important because, without effective configuration change controls, the risk increases that changes being introduced could compromise the security, efficiency, and effectiveness of a post’s systems as well as the data that reside on them. Furthermore, the lack of uniformity and consistency with the current LCCB change request process leads to inefficiencies when LCCB members rotate to a new post assignment.
Report Terms
Report Recommendations
OIG recommends that the Bureau of Information Resource Management require that all IT configuration changes approved by the Local Configuration Control Boards at overseas posts be tested before implementation, in accordance with Federal requirements and Department of State policies.
OIG recommends that the Bureau of Information Resource Management require Local Configuration Control Boards to perform and document security impact analyses on all configuration change requests before approval, in accordance with National Institute of Standards and Technology guidance.
OIG recommends that the Bureau of Information Resource Management provide guidance to Local Configuration Control Boards on the documentation regarding IT configuration change requests that must be retained at a post.
OIG recommends that the Bureau of Information Resource Management develop and issue standard operating procedures for overseas posts’ Local Configuration Control Boards to follow when reviewing, approving, and implementing IT configuration change requests. These standard operating procedures should establish and implement a process that provides for the evaluation, approval, and documentation of IT change requests in accordance with Department of State policies and National Institute of Standards and Technology requirements.
OIG recommends that the Bureau of Information Resource Management develop and implement a methodology to oversee Local Configuration Control Board (LCCB) activities, including LCCB approval of IT configuration change requests at the local level. This methodology should include specific procedures for verification of the LCCB’s testing of approved changes, security impact analyses, and retention of required documentation.
OIG recommends that the Bureau of Information Resource Management (IRM) formally designate oversight responsibility for Local Configuration Control Board activities to a specific position or office within IRM and establish a formal mechanism for communicating the oversight roles and responsibilities.